WordPress Now Blocks High-Risk Plugin Updates Before Distribution

WordPress is adding an automated security review for each release of every plugin before that release is distributed through the WordPress.org update API. The change is meant to catch high-risk code before it reaches the websites that rely on automatic updates, and it is the latest step in the platform's effort to improve WordPress plugin security.

The WordPress.org plugin repository has long reviewed new plugins before they enter the directory, but after that initial check, updates have shipped continuously. David Perez, co-lead of the WordPress Official Plugin Repository Team, explained that a plugin can be secure today and introduce a vulnerability or malicious code in a future release. WordPress itself said the absence of a consistent review step between the commit of a release and the release of a plugin to downstream users could open the door to malicious attacks. Since June 5, 2026, every plugin and theme has passed through a cooldown period before being distributed through auto-updates under an initiative called Protect The Shire. The cooldown adds friction so malicious updates do not reach end users immediately, and it currently stands at six hours, reduced from an original 24 hours.

The value of that waiting window became clear on July 28, 2026, when the automated review detected a backdoor committed to a release of a plugin with about 20,000 active installations. Because the release was inside the cooldown period, the compromised version never reached the WordPress.org update API. WordPress security company Wordfence alerted the Plugins Team, and the plugin was closed for downloads 26 minutes later. WordPress did not disclose the plugin name. The quick detection and closure show how automated review and human response can work together to keep a malicious update away from site owners.

The newest change closes another gap by making a high-risk score automatically halt distribution without requiring intervention from the Plugins Team. During the cooldown period, the changes in each release are analyzed by artificial intelligence models and Jetpack Scan, a security scanning tool. Those results are cross-verified and combined into a security score; a higher score means a potentially higher risk. Releases with a high risk score are blocked automatically once the review completes, while releases below that threshold continue the normal process. Plugin committers receive an email with findings only when a plugin is blocked.

A high risk score does not necessarily indicate malicious intent. The score can flag an accidentally introduced security flaw just as it flags intentional malware. Perez said the automated review looks for the same vulnerability classes any security audit would look for. Developers are urged to follow WordPress Coding Standards and PHP_CodeSniffer rules to validate their code, and WooCommerce extension authors are recommended to use the Quality Insights Toolkit testing platform. The scoring system pays attention to several dangerous patterns. A REST, AJAX or admin-post endpoint without a capability check can let an unauthorized request perform an action; a capability check is a test that the person or program has the right permission, and a nonce alone, which only verifies that a request came from a valid form, is not enough. Queries built without a prepared statement can allow attackers to alter the database command itself. Building file paths, uploads, deletions or includes directly from request data can let an attacker point the code at a file they control. Using unserialize on request data or a remote response, writing options or user settings from endpoints reachable by subscribers or unauthenticated users, and fetching or evaluating code at runtime, including obfuscated or packed code, are all signals that drive the risk score up.

Once a release is blocked, the only way for the developer to lift the restriction is to review the findings, fix the issues, and publish a new release. If that new release scores below the high-risk threshold, it continues through the normal cooldown process. If a finding looks incorrect, authors can contact the Plugins Team, but Perez advised that the team handles a high volume of reviews, so publishing a fixed release is almost always faster than waiting for a manual appeal. That approach keeps the ecosystem moving while still keeping dangerous code out of the update stream.

For website owners who rely on WordPress plugins, the automated block adds another layer of protection before risky code lands on their sites. Managing plugin updates and security is easier on a managed WordPress hosting platform; AEU Hosting provides managed WordPress hosting with security measures and streamlined update handling that can reduce the workload for site owners and help them keep their sites safer.